SB2021112314 - Multiple vulnerabilities in Advantech R-SeeNet

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021112314

SB2021112314 - Multiple vulnerabilities in Advantech R-SeeNet

Published: November 23, 2021 Updated: December 16, 2021

Security Bulletin ID SB2021112314
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 26
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 88% Low 12%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 26 vulnerabilities.


1) SQL injection (CVE-ID: CVE-2021-21918)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "name_filter" parameter in "company_list" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


2) SQL injection (CVE-ID: CVE-2021-21919)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "ord" parameter in "company_list" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


3) SQL injection (CVE-ID: CVE-2021-21926)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "health_filter" parameter in the "sn_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


4) SQL injection (CVE-ID: CVE-2021-21937)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "host_alt_filter" parameter in the "sn_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


5) SQL injection (CVE-ID: CVE-2021-21936)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "health_alt_filter" parameter in the "sn_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


6) SQL injection (CVE-ID: CVE-2021-21935)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "host_alt_filter2" parameter in the "sn_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


7) SQL injection (CVE-ID: CVE-2021-21934)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "imei_filter" parameter in the "sn_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


8) SQL injection (CVE-ID: CVE-2021-21933)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "esn_filter" parameter in the "sn_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


9) SQL injection (CVE-ID: CVE-2021-21932)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "name_filter" parameter in the "sn_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


10) SQL injection (CVE-ID: CVE-2021-21931)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "stat_filter" parameter in the "sn_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


11) SQL injection (CVE-ID: CVE-2021-21930)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "prod_filter" parameter in the "sn_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


12) SQL injection (CVE-ID: CVE-2021-21929)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "prod_filter" parameter in the "mac_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


13) SQL injection (CVE-ID: CVE-2021-21928)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "loc_filter" parameter in the "mac_filter" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


14) SQL injection (CVE-ID: CVE-2021-21927)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "loc_filter" parameter in the "device_list" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


15) SQL injection (CVE-ID: CVE-2021-21925)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "firm_filter" parameter in the "device_list" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


16) SQL injection (CVE-ID: CVE-2021-21924)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "desc_filter" parameter in the "device_list" page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


17) SQL injection (CVE-ID: CVE-2021-21923)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "company_filter" parameter in "user_list" page. A remote attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


18) SQL injection (CVE-ID: CVE-2021-21922)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "username_filter" parameter in "user_list" page. A remote attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


19) SQL injection (CVE-ID: CVE-2021-21921)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "name_filter" parameter in "user_list" page. A remote attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


20) SQL injection (CVE-ID: CVE-2021-21920)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "surname_filter" parameter in "user_list" page. A remote attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


21) SQL injection (CVE-ID: CVE-2021-21917)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "ord" parameter in group_list page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


22) SQL injection (CVE-ID: CVE-2021-21916)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "description_filter" parameter in group_list page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


23) SQL injection (CVE-ID: CVE-2021-21915)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "company_filter" parameter in group_list page. A remote authenticated attacker can send a specially crafted request to the affected application and gain access to sensitive information on the system.


24) Incorrect default permissions (CVE-ID: CVE-2021-21912)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear


The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions in the Windows version of installation within the "Apache2.2" service binary file in the directory. A local user with access to the system can view contents of files and directories or modify them.


25) Incorrect default permissions (CVE-ID: CVE-2021-21911)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear


The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions in the Windows version of installation within the "SnmpMonSvs" service binary file in the directory. A local user with access to the system can view contents of files and directories or modify them.


26) Incorrect default permissions (CVE-ID: CVE-2021-21910)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear


The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions in the Windows version of installation within the "mysql" service. A local user with access to the system can view contents of files and directories or modify them.


Remediation

Install update from vendor's website.

References